14 Apr, 2008
33 commits
-
Commit 9335f047fe61587ec82ff12fbb1220bcfdd32006 aka
"[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW"
added per-netns _view_ of iptables rules. They were shown to user, but
ignored by filtering code. Now that it's possible to at least ping loopback,
per-netns tables can affect filtering decisions.netns is taken in case of
PRE_ROUTING, LOCAL_IN -- from in device,
POST_ROUTING, LOCAL_OUT -- from out device,
FORWARD -- from in device which should be equal to out device's netns.
This code is relatively new, so BUG_ON was plugged.Wrappers were added to a) keep code the same from CONFIG_NET_NS=n users
(overwhelming majority), b) consolidate code in one place -- similar
changes will be done in ipv6 and arp netfilter code.Signed-off-by: Alexey Dobriyan
Signed-off-by: Patrick McHardy -
Dump the mark value in log messages similar to nfnetlink_log. This
is useful for debugging complex setups where marks are used for
routing or traffic classification.Signed-off-by: Patrick McHardy
-
Patch splits creation of /proc/net/nf_conntrack, /proc/net/stat/nf_conntrack
and net.netfilter hierarchy into their own functions with dummy ones
if PROC_FS or SYSCTL is not set. Also, remove dead "ret = 0" write
while I'm at it.Signed-off-by: Alexey Dobriyan
Signed-off-by: Patrick McHardy -
This expresses __skb_queue_tail() in terms of __skb_insert(),
using __skb_insert_before() as auxiliary function.Signed-off-by: Gerrit Renker
Signed-off-by: David S. Miller -
This expresses __skb_append in terms of __skb_queue_after, exploiting that
__skb_append(old, new, list) = __skb_queue_after(list, old, new).
Signed-off-by: Gerrit Renker
Signed-off-by: David S. Miller -
By reordering, __skb_queue_after() is expressed in terms of __skb_insert().
Signed-off-by: Gerrit Renker
Signed-off-by: David S. Miller -
By rearranging the order of declarations, __skb_dequeue() is expressed in terms of
* skb_peek() and
* __skb_unlink(),thus in effect mirroring the analogue implementation of __skb_dequeue_tail().
Signed-off-by: Gerrit Renker
Signed-off-by: David S. Miller -
This patches adds a call to increment IPSTATS_MIB_OUTFORWDATAGRAMS
when forwarding the packet in ip6_mr_forward() in the IPv6 multicast
routing module (net/ipv6/ip6mr.c).Signed-off-by: Rami Rosen
Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller -
Signed-off-by: Jan Engelhardt
Signed-off-by: David S. Miller -
Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller -
Since NETDEV_REGISTER notifier chain is responsible for creating
inet6_dev{}, we do not need to call ipv6_find_idev() directly here.Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller -
The inet6_lookup family of functions requires a net to lookup
a socket in, so give a proper one to them.No more things to do for dccpv6, since routing is OK and the
ipv4-like transport layer filtering is not done for ipv6.Signed-off-by: Pavel Emelyanov
Signed-off-by: David S. Miller -
Move the call to inet_ctl_sock_create to init callback (and
inet_ctl_sock_destroy to exit one) and use proper ctl sock
in dccp_v6_ctl_send_reset.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
And replace all its usage with init_net's socket.
Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
They will be responsible for ctl socket initialization, but
currently they are void.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
This call uses the sock to get the net to lookup the routing
in. With CONFIG_NET_NS this code will OOPS, since the sk ptr
is NULL.After looking inside the ip6_dst_lookup and drawing the analogy
with respective ipv6 code, it seems, that the dccp ctl socket
is a good candidate for the first argument.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
This enables sockets creation with IPPROTO_DCCP and enables
the ip level to pass DCCP packets to the DCCP level.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
The inet_lookup family of functions requires a net to lookup
a socket in, so give a proper one to them.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
The dccp_v4_route_skb used in dccp_v4_ctl_send_reset, currently
works with init_net's routing tables - fix it.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
Move the call to inet_ctl_sock_create to init callback (and
inet_ctl_sock_destroy to exit one) and use proper ctl sock
in dccp_v4_ctl_send_reset.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
And replace all its usage with init_net's socket.
Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
They will be responsible for ctl socket initialization, but
currently they are void.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
According to the overall struct net design, it will be
filled with DCCP-related members.Signed-off-by: Pavel Emelyanov
Acked-by: Arnaldo Carvalho de Melo
Signed-off-by: David S. Miller -
Move it to tcp_seq_afinfo->seq_fops as should be.
Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
No need to have separate never-used variable.
Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
Replace seq_open with seq_open_net and remove tcp_seq_release
completely. seq_release_net will do this job just fine.Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
No need to create seq_operations for each instance of 'netstat'.
Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
tcp_proc_register/tcp_proc_unregister are called with a static pointer only.
Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller -
drivers/atm/horizon.c has unusually large number
of static inline functions - 36.I looked through them. Most of them seems to be small enough,
but a few are big, others are using udelay or busy loop,
and as such are better not be inlined.This patch removes "inline" from these static functions
(regardless of number of callsites - gcc nowadays auto-inlines
statics with one callsite).Size difference for 32bit x86:
text data bss dec hex filename
8201 180 6 8387 20c3 linux-2.6-ALLYES/drivers/atm/horizon.o
7840 180 6 8026 1f5a linux-2.6.inline-ALLYES/drivers/atm/horizon.oSigned-off-by: Denys Vlasenko
Signed-off-by: David S. Miller -
sk_reuse is declared as "unsigned char", but is set as type valbool in net/core/sock.c.
There is no other place in net/ where sk->sk_reuse is set to a value > 1, so the test
"sk_reuse > 1" can not be true.Signed-off-by: Gerrit Renker
Signed-off-by: David S. Miller -
This patch modifies TIPC's socket code to use standard kernel
routines to handle time conversions between jiffies and ms.
This ensures proper operation even when HZ isn't 1000.Acknowledgements to Eric Sesterhenn for
identifying this issue and proposing a solution.Signed-off-by: Allan Stephens
Signed-off-by: David S. Miller -
This patch eliminates re-initialization of the standard socket
wait queue used for sleeping in TIPC's socket creation code.Signed-off-by: Allan Stephens
Signed-off-by: David S. Miller
13 Apr, 2008
7 commits
-
The xfrm_get_policy() and xfrm_add_pol_expire() put some rather large structs
on the stack to work around the LSM API. This patch attempts to fix that
problem by changing the LSM API to require only the relevant "security"
pointers instead of the entire SPD entry; we do this for all of the
security_xfrm_policy*() functions to keep things consistent.Signed-off-by: Paul Moore
Acked-by: James Morris
Signed-off-by: David S. Miller -
Smack doesn't have the need to create a private copy of the LSM "domain" when
setting NetLabel security attributes like SELinux, however, the current
NetLabel code requires a private copy of the LSM "domain". This patches fixes
that by letting the LSM determine how it wants to pass the domain value.* NETLBL_SECATTR_DOMAIN_CPY
The current behavior, NetLabel assumes that the domain value is a copy and
frees it when done* NETLBL_SECATTR_DOMAIN
New, Smack-friendly behavior, NetLabel assumes that the domain value is a
reference to a string managed by the LSM and does not free it when doneSigned-off-by: Paul Moore
Acked-by: James Morris
Signed-off-by: David S. Miller -
Signed-off-by: Joe Perches
Signed-off-by: David S. Miller -
Add a new sctp mailing list linux-sctp@vger.kernel.org.
Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
The 'asoc' parameter to sctp_cmd_hb_timer_update() is unused, and
we can remove it.Signed-off-by: Gui Jianfeng
Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
Replacing (almost) all invocations of list_for_each() with
list_for_each_entry() tightens up the code and allows for the deletion
of numerous list iterator variables that are no longer necessary.Signed-off-by: Robert P. J. Day
Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller
